Show Notes:

The data exposed via pastebin mostly came from UNDP.org, the UN Development Program, but also included the Organisation for Economic Co-operation and Development (OECD), the World Health Organisation (WHO) and the UK’s Office for National Statistics (ONS)

The UN responded saying “The server goes back to 2007. There are no active passwords listed for those accounts” and “Please note that UNDP.org was not compromised.”

Even though the UN claims the data is not current, it suggests that passwords are stored in plain text, without salting and hashing, and that no password requirements are enforced. Many of the passwords appeared to be overly short, and did not contain

Teampoison hackers have previously attacked the RIM/Blackberry website and published private information about former UK Prime Minister Tony Blair

Teampoison included a message with the pastebin, officially joining Anonymous in Operation Robinhood, against banks and financial institutions

On October 20 at around 18:00 GMT, the root user logged in to a number of Duqu C&C servers and proceeded to destroy /root, /etc, /var/log and some other files

The attackers securely erased the log files so they could not be recovered

However, due to the nature of the ext3 file system, some fragments of the logs had been relocated to reduce fragmentation, and these bits were not securely erased. While brute force searching the slack space, Kaspersky Labs was able to find a fragment of sshd.log showing root logins and the source IP address from another server in Germany.

Researchers followed the trail back to Germany, and used the same technique to find more IP addresses. However the logs were from mid November (and were found in early November), and do not indicate which year. Based on other log files, this server may back been part of the Duqu C&C infrastructure as far back as 2009.

There is also evidence that the Duqu operators upgrading the OpenSSH that came with CentOS on the server, to the latest versions, 5.8p1 and 5.8p2 when they were released. The attackers also enabled GSSAPIAuthentication on all of their servers. The article below includes more evidence of a possible long lived 0-day exploit for OpenSSH 4.3

The Duqu C&C network was made up of hacked servers from all over the world, including: Vietnam, India, Germany, Singapore, Switzerland, the UK, the Netherlands, Belgium, and South Korea. Most if not all of the compromised machines were running CentOS

These servers were used as reverse proxies to the real C&C Mothership, which still has not been identified.

Feedback:

Q: What OS
A: FreeBSD 9.0-RC2, Will upgrade to 9.0-RELEASE when it comes out.

Q: What version of ZFS?
A: ZPool 28 and ZFS 5 (ZPool 21 introduces the deduplication system, which isn’t available in FreeBSD 8.2 which only has ZPool 15)

Q: What kind of throughput do you get?
A: Sequential read and write: 600+ megabytes/second. I write out a 16gb file in under 27 seconds. Reading it back took under 2.8 seconds (over 6 gigabytes/sec) because the entire file was stored in the ZFS ARC (Adaptive Replacement Cache)

Q: Do you suggest I build a server or buy a server?
A: I usually build, but I am a control freak. Buying can be a good option too

Q: What about the RAID Controller
A: Adaptec 6805, comes with FreeBSD drivers for 6.x, 7.x and 8.x, but not 9.x (because it is not out yet). Luckily, they include the source code, so I was able to compile the driver as a loadable module for 9.x. Adaptec has also submitted the changes to FreeBSD to be included in future releases.

Direct Download Links:

Show Notes:

Authorities of the Romania Directorate for Investigating Organized Crime and Terrorism (DIICOT) have arrested a 26 year old who is accused to breaking in to multiple servers at NASA

The authorities claim that the attacker destroyed protected data and restricted access to it, resulting in a loss of over $500,000

Charges against Robert Butyka include:

obtaining unauthorized access and causing severe disruptions to a computer system

modifying, damaging and restricting access to data without authorization

possession of hacking programs

“Through criminal activity, the accused severely affected the operation of computer servers by introducing, modifying and damaging electronic data and restricting access to it,” DIICOT said in a statement.

He is to be tried in Romania, as there has been no extradition request.

Valve had not yet determined if the database had been copied or viewed

Valve originally believed that only the user forums had been compromised, but during the investigation it was determined that the compromised extended to all user data

Valve reports that they have not noticed an increase in login attempts and have not received any reports of misused credit cards. This suggests that the data was either not taken, or is sufficiently protected to delay its use.

If the database was taken, I would expect to see a spear phishing attack, using the name, username and email address of the users to ask them to ‘reset’ their steam password.

All forum accounts will require a password reset, however valve is not forcing a password reset on all steam accounts.

Private Browsing mode stops the browser from recording history, and isolates your cookies, not sending cookies from regular browsing mode, and removing the new cookies when you leave private mode.

Research has found that many plugins do not respect private mode, especially Adobe Flash, which has its own separate cookie system. This means a site that you visited in private mode, could read those cookies even in regular mode, and vice versa . Flash has since been fixed, make sure you upgrade.

Chrome and Internet Explorer have taken to automatically disabling plugins in private mode

Feedback:

For a list of the advantages of ZFS, you should watch the ZFS episode of TechSNAP. For the other file systems, really you can only compare them against another file system. UFS has advantages over ext2/3, specifically with its ability to store millions of files in a single directory.

For checking your email over 3G/4G, you should still use SSL in your phone’s mail client.

Show Notes:

The malware was said to have infected as many as 4 million computers in 100 countries

Atleast 500,000 infected machines in the USA alone

Operation Ghost Click resulted in indictments against six Estonian and one Russian national. The Estonians were taken in to custody by local authorities and the US is seeking to extradite them.

The malware, called DNSChanger, changed the users DNS servers, to use rogue servers run by the botnet operators, and allowed the attackers to basically perform man-in-the-middle attacks against any site they wished.

The attackers redirected all traffic related to Apple and iTunes to a site that sold fake apple software and pirated music.

The attackers also stole traffic from legitimate advertising networks and replaced it with their own network, charging advertisers for their ill gotten traffic.

The malware also blocked windows update and most known virus scanners and help sites.

The vulnerability (since fixed) allowed an attacker to completely take over administrative rights on another AWS account, including starting new EC2 and S3 instances, and deleting instances and storage

An attacker could have run up a huge bill very quickly, and it would appear legitimate.

Using EC2 to crack passwords becomes even more effective when someone else is paying for your instances

The vulnerability was exploited using an XML signature wrapping attack, allowing them to modify the signed message while still having it verify as unmodified.

Amazon said “customers fully implementing the AWS security best practices were not susceptible to these vulnerabilities”

Feedback:

There are a number of tools that will overwrite the contents of your hard drive a number of times in various patterns. The goal here is to ensure that any data that was on the drive can not be recovered. There is never a guarantee that the data will not be recoverable.

It is still a very good idea to overwrite the data on your disks before you recycle/sell them. The methods are slightly different now, specifically, some methods such as the ‘Gutmann Wipe’ which was designed for a specific type of disk encoding that is no longer users in modern hard drives are no longer effective.

DBAN supports a number of methods:

PRNG Stream (recommend) – literally overwrites the entire drive with a stream of data from the Pseudo Random Number Generator. It is recommended that you use 4 passes for medium security, and 8 or more passes for high security.

DoD 5220.22-M – The US Department of Defence 7 pass standard. The default is DBAN is the DoD Short, which consists of passes 1, 2 and 7 from the full DoD wipe.

Quick Erase (Not recommended) – Overwrite the entire drive from 0s, only 1 pass. This is designed for when you are going to reuse the drive internally, and is not considered secure at all

DBAN also verifies that the data was overwritten properly, by reading back the data from the drive and verifying that the correct pattern is found.

I am not certain about the answer to your question concerning SD cards and other flash storage not in the form of a hard disk. A file erasure utility may be the only option if the device does not actually accept ATA/SCSI commands (careful, some USB devices pretend to accept the commands but just ignore ones they do not understand)

Simon’s method of using the shred utility (designed to overwrite an individual file) on the block device, is not recommended. a proper utility like DBAN uses ATA/SCSI commands to tell the disk to securely erase it self, which involves disabling write caching, and erasing unaddressable storage such as those that have been relocated due to bad sectors.

Special consideration should be given to SSDs, as they usually contain more storage than advertised, and as the flash media wears out, it is replaced from this additional storage. You want to be sure your overwrite utility overwrites the no-longer-used sectors as they will still contain your data. This is why a utility that uses the proper ATA/SCSI commands is so important.

A utility like DBAN is also required if the disk contained business or customer data. Under legislation such as PIPEDA (Personal Information Protection and Electronic Documents Act, Canada), HIPAA and Sorbanes-Oxley (USA), the information must be properly destroyed.

Called Duqu, the malware appears to be based on the same concepts as Stuxnet, and likely was written by some of the same people, or someone with access to the Stuxnet source code.

The malware is designed to be stealthy and silent, rather than exploiting the system to some gain, like most malware

The rootkit loads it self as a validly signed driver. It appears to have been signed by the certificate of a company in Taiwan identified as C-Media Electronics Incorporation. It is possible that their systems were compromised and their private key is being used without their knowledge. The certificate was set to expire on August 2, 2012, but authorities revoked it on Oct. 14

The malware is not a worm, as it does it spread, and has no destructive payload

It appears to only gather intelligence and act as a espionage agent, collecting data to be used a future attack.

Analysts claim it appears to be seeking information on an unidentified industrial control system

Duqu appears to have been in operation, undetected for more than a year

Symantec has declined to name the countries where the malware was found, or to identify the specific industries infected, other than to say they are in the manufacturing and critical infrastructure sectors

Users who do a search while logged in, will do the search over SSL, meaning their search query and the results will be protected from snooping by their ISP, Government, Law Enforcement and WiFi hackers.

This is an important step as google works to personalize your search results more and more.

An interesting side effect of this is that browsers do not pass referrer headers when you transition from an SSL site. So the sites you visit from the search results page will no longer see what your search query was. Clicks on Adwords and other sponsored links will still pass your search query.

The primary impediment to SSL for everything is performance, encrypting all traffic on the web would require a great deal more hardware. This is why Google defaults to a weaker encryption for things like search results, than what online merchants typically use.

Another impediment to SSL is the certificate system, typical setups require a unique IP for each SSL certificate (because the name based virtual hosting typically done by web servers relies on an HTTP header, that is not sent until after the encryption session is started). However modern browsers and web servers support ‘SNI’ (Server Name Indication) to allow that information to be passed as part of the initial encryption setup. There are also solutions such as wildcard certificates (ie, *.google.com) and Unified Communications Certificates (UCC, typically used for MS Exchange servers and the like).

Google will also provide website owners with the top 1000 search queries that lead visitors to their site via Google Webmaster Tools.

ZFS Segment

This week we will be taking a look at ZFS as a storage solution

ZFS was originally developed by Sun Microsystems to be able to store a zetta byte of data (A zetta byte is equal to 1 billion tera bytes)

ZFS is both the Volume Manager and the File System. This gives it some unique benefits, including the ability to increase the size of the file system on the fly and improves performance for the ‘scrub’ (integrity check all data) and resilver (recover from a failed disk) operations, as only data blocks that are actually in use need to be rewritten, whereas a hardware RAID controller must resilver the entire disk because it is unaware of the file system.

ZFS is a ‘Copy-On-Write’ file system, this means that data is not immediately overwritten when it is changed

Features

Multiple mount points – You can create various mount points from the same storage pool, allowing you to have different settings for different types of files.

Passive Integrity Checking (Fletcher Checksum or SHA–2) – As data is read, it is compared against the checksum (or hash, depending on settings). If the data is found to be corrupted, ZFS attempts to recover it (from a mirrored device, RAID Z, or copies). This feature allows ZFS to detect silent corruption that normally goes unnoticed.

RAID Z – RAID Z works very similar to RAID 5, except without the requirement for a hardware RAID controller. RAID Z2 provides two parity drives, like RAID 6. Recently, RAID Z3 was also introduced, using 3 drives for parity, providing exceptional fault tolerance.

Compression – Allow you to compress the data stored in this mount point (defaults to lzjb for speed, or you can choose a specific level of gzip). This can be great for storing highly compressible information such as log files

Deduplication – Since ZFS already knows the hash of your files as it writes them, it can detect that a file with the identical content already exists in your storage pool, and it will simply link the new file to the old one, and because ZFS is copy-on-write, if either file changes, it does not effect the other. ZFS also supports an optional ‘verify’ setting, where even if the checksum/hash matches, it will do a byte-by-byte verification to ensure the files are the same, to avoid a cache collision resulting in data corruption, even though the chances of this happening are around 10^–77. Deduplication uses a lot of ram, so it is recommended that you only use it on datasets where there is a high probability of duplication (It requires 320 bytes per block, meaning 1TB of data in 8kb blocks requires 32GB of ram. ZFS allows blocks up to 128kb). Deduplication will only use up to 25% of ARC memory, after that performance is degraded.

Purposeful Duplication (Copies) – Allows you to ask ZFS to maintain more than 1 copy of each file in a mount point. This is in addition to any redundancy provided by mirrors/RAID Z etc. Where possible the additional copies are stored on different physical devices. This allows you to get the benefit of a system like RAID Z but only for a specific set of data, while using regular striping for the rest, to maximize your storage capacity. (The ‘Copies’ system was not designed to protect against entire drives failing, just the loss of specific sectors, also this setting only effects newly created files, so you should set it when you create the mount point)

Snapshots – A read only copy of the file system from a specific point in time, great for backups etc.

Clones – A writable snapshot. Allows you to create a second copy of the file system that shares all of the same disk space, and any changes to either the original or the clone get saved separately.

Dynamic Striping – As you add more disks to your ZFS pool, the strips are automatically adjusted to take advantage of the write performance of all available disks.

Space Reservation – Since all mount points share the same pool of free space, you can set reservations to make sure specific mount points always have access to free space, even if another mount point is trying to use all of the space.

In summary, ZFS can be a great solution for your home file server, as it allows you the flexibility to add additional storage at any time, deduplicate files, provided limited redundancy without needing RAID and can even provide some Drobo like functionality.

If you keep at least one SATA port available in your file server, you can replace smaller devices by attaching the newer drive, and using the ‘zpool replace’ command, to copy all of the data to the new device, then remove the smaller one. You can eventually replace every device in the system this way, and the storage pool sizes up automatically.

RAID Z pools cannot currently have devices added to them, although this feature is in the works. If you create a RAID Z (or Z2/Z3) pool, you can still increase it’s storage capacity by replacing each disk one at a time, and waiting for it to resilver (unlike in non-redundant setups, you do not have to connect the new device before removing the old one). Again, because ZFS is both the Volume Manager and the File System, the resilvering process is faster, because only data that is actually in use needs to be written to the new device.